MikroTik RouterOS Behavioral Workflow Vulnerability Added to CISA KEV Catalog

What's on the official record

25 September — CVE-2026-67279 added to the KEV catalog. CISA added CVE-2026-67279, a MikroTik RouterOS improper enforcement of behavioral workflow vulnerability (CWE-841), to the Known Exploited Vulnerabilities Catalog on 25 September 2026. The record states the vulnerability could allow an unauthenticated client to open a session channel and send an exec request, and that it can be chained to achieve unauthenticated exploitation of CVE-2026-86060. CISA's remediation due date for federal civilian agencies is 28 September 2026, and the catalog version is 2026.10.21. The CVE record names fixed versions 7.24.2 and 7.23.4. The catalog does not record known ransomware use. FIRST's EPSS model estimates a 0.010 probability of exploitation (64th percentile, 2026-10-23). CISA's ADP SSVC decision records exploitation as active, automatable yes, impact partial.

Assessment

For a platform or AI-stack owner, the record lets you check RouterOS instances against the first fixed versions 7.24.2 and 7.23.4 and patch or isolate any instance below them. The record ties the vulnerability to an unauthenticated client opening a session channel and sending an exec request, so you can decide whether to pull or patch affected versions before the chain to CVE-2026-86060 is exercised.

For a cyber underwriter, the record lets you check policyholders' RouterOS estates against fixed versions 7.24.2 and 7.23.4 and require a control or price accordingly. The catalog does not record known ransomware use, and CISA's ADP records active exploitation with partial impact, which you can weigh when deciding whether to bind or exclude.

What would change this call

A revised EPSS estimate or a change to CISA's ADP SSVC decision would change the severity weighting. A catalog update recording ransomware use would change the underwriting posture.

What to check next

Confidence

Filed 25 October 2026 from the record dated 25 September 2026.

Sources

[1] Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-67279

[2] CVE record CVE-2026-67279 — https://www.cve.org/CVERecord?id=CVE-2026-67279

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog